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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . S This communication is responsive to 09/14/2007 , 

2. S The allowed claim(s) is/are 18-25.30 and 34-38 . 

3. 1^ Acknowledgment Is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a) S All b) □ Some* c) □ None of the: 

1. S Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received In Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying Indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1. □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. M Information Disclosure Statements (PTO/SB/08). 

Paper No./Mail Date 10/03/2007 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. □ Examiner's Amendment/Comment 

8. S Examiner's Statement of Reasons for Allowance 

9. □ Other . 
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Reasons for Allowance 

1. Claims 18-25,30,34-38 will be allowed. 

2. The following is an examiner's statement of reasons for allowance. 

The prior art references most closely resembling the applications claimed invention are Vaidya 
U.S PAT(6,279, 1 1 3) and Spiegel U.S.PAT(6,954,765). 

First Vaidya disclosed, "A dynamic signature-based network intrusion detection system (IDS) 
that includes multiple attack signature profiles which are descriptive of identifiable 
characteristics associated with particular network intrusion attempts associated with network 
objects located on the network". However Vaidya did not disclose, "determining if any entry 
exists in said normalization table for said packet fragment said entry including an identifier 
comprising identifying information from identification protocol, source IP address and 
destination IP address header fields of said packet fragment; if said entry exists in said 
normalization table, determining if a conflict exists between said entry and said a prior entry; if 
said conflict exists, discarding said packet fragment; and if said conflict does not exist, 
simultaneously transferring said packet fragment to a network intrusion detection system and 
said end-system of said local network" (Claims 18,30,37). 

Second Spiegel disclosed, " a system that updates a file by making a backup copy of a portion of 
the file that includes changed data". However Spiegel did not disclose, "determining if any entry 
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exists in said normalization table for said packet fragment said entry including an identifier 
comprising identifying information from identification protocol, source IP address and 
destination IP address header fields of said packet fragment; if said entry exists in said 
normalization table, determining if a conflict exists between said entry and said a prior entry; if 
said conflict exists, discarding said packet fragment; and if said conflict does not exist, 
simultaneously transferring said packet fragment to a network intrusion detection system and 
said end-system of said local network" (Claims 18,30,37). 

In summary, the Examiner submits that there is no motivation to combine the aforementioned 
references; therefore, claims 18-25,30,34-38 have been deemed allowable over the prior art. 
Any comments considered necessary by applicant must be submitted no later than the payment 
of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such 
submissions should be clearly labeled "Conmients on Statement of Reasons for Allowance". 

Any inquiry conceming this communication or earlier communication from the examiner should 

be directed to Adnan Mirza whose telephone number is (571)-272-3885. 

The examiner can normally be reached on Monday to Friday during normal business hours. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Jason 
Cardone can be reached on (571)-272-3933. The fax for this group is (703)-746-7239. The fax 
phone number for the organization where this application or proceeding is assigned is 571-273- 
8300. 
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Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for un published 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto,gQv . Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at (866)-2 1 7-9 1 97 (toll-free). 
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